merill Lokka SSRF in Azure Resource Manager URL path construction

Executive brief

Lokka, a library used for interacting with Azure services, contains a flaw in how it handles web addresses for Azure Resource Manager. An attacker could provide a specially crafted input that tricks the software into sending sensitive Azure login tokens to a server controlled by the attacker. This could lead to the unauthorized access of your Azure cloud resources and data.

Technical details

Lokka versions prior to 2.1.2 are vulnerable to Server-Side Request Forgery (SSRF) and credential leakage (CWE-918). The vulnerability exists because the library constructs Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. An attacker can provide a specially crafted path that alters the URL authority parsing, causing the library to send Azure Resource Manager bearer tokens to an attacker-controlled host instead of the legitimate management.azure.com endpoint. This is a network-reachable vulnerability requiring no authentication or user interaction. The issue is fixed in version 2.1.2 by implementing path validation and using the standard URL API for construction.

Affected products

• merill @merill/lokka < 2.1.2

Timeline

• 2026-06-19: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched: Fixed in version 2.1.2

References

• https://api.github.com/users/hackchang
• https://github.com/hackchang
• https://api.github.com/users/hackchang/gists%7B/gist_id%7D
• https://api.github.com/users/hackchang/repos
• https://avatars.githubusercontent.com/u/58034363?v=4
• https://api.github.com/users/hackchang/events%7B/privacy%7D